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Abstract 

We propose a new definition of actual causes, using structural equations to model 
counterfactuals. We show that the definition yields a plausible and elegant account of 
causation that handles well examples which have caused problems for other definitions 
and resolves major difficulties in the traditional account. 
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1 Introduction 



What does it mean that an event C actually caused event E7 The problem of defining "ac- 
tual cause" goes beyond mere philosophical speculation. As Good 111993 J and Michie 119991 
argue persuasively, in many legal settings, what needs to be established (for determining re- 
sponsibility) is exactly such "cause in fact". A typical example [Wright 1988 1 considers two 



fires advancing toward a house. If fire A burned the house before fire B, we (and many juries 
nationwide) would consider fire A "the actual cause" for the damage, even supposing that the 
house would definitely have been burned down by fire B, if it were not for A. Actual causation 
is also important in artificial intelligence applications. Whenever we undertake to explain a 
set of events that unfold in a specific scenario, the explanation produced must acknowledge 
the actual cause of those events. The automatic generation of adequate explanations, a task 
essential in planning, diagnosis, and natural language processing, therefore requires a formal 
analysis of the concept of actual cause. 

The philosophy literature has been struggling with this problem of defining causality since 
at least the days of Hume 117391 . who was the first to identify causation with counterfactual 
dependence. To quote Hume 117481 Section VIII]: 

We may define a cause to be an object followed by another, where, if the first 
object had not been, the second never had existed. 

Among modem philosophers, the counterfactual interpretation of causality continues to re- 
ceive most attention, primarily due to the work of David Lewis II1973I . Lewis has given 
counterfactual dependence formal underpinning in possible- world semantics and has equated 
actual causation with the transitive closure of counterfactual dependencies. C is classified 
as a cause of E if C is linked to E" by a chain of events each directly depending on its 
predecessor. However, Lewis's dependence theory has encountered many difficulties. (See 
llCollins, Hall, and Paul 2004llHall and Paul 2()()3tlPearl 2()()()t|Sosa and Tooley 1993| for some 
recent discussion.) The problem is that effects may not always counterfactually depend on their 
causes, either directly or indirectly, as the two-fire example illustrates. In addition, causation 
is not always transitive, as implied Lewis's chain-dependence account (see Example 14.31 ). 

Here we give a definition of actual causality cast in the language of structural equations. 
The basic idea is to extend the basic notion of counterfactual dependency to allow "contingent 
dependency". In other words, while effects may not always counterfactually depend on their 
causes in the actual situation, they do depend on them under certain contingencies. In the 
case of the two fires, for example, the house burning down does depend on fire A under the 
contingency that firefighters reach the house any time between the actual arrival of fire A and 
that of fire B. Under that contingency, if fire A had not been started, the house would not have 
burned down. The house burning down also depends on fire A under the contingency that fire B 
was not started. But this leads to an obvious concern: the house burning down also depends on 
fire B under the contingency that fire A was not started. We do not want to consider this latter 
contingency. Roughly speaking, we want to allow only contingencies that do not interfere with 
active causal processes. Our formal definition of actual causality tries to make this precise. 
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In Part II of the paper [Halpern and Pearl 2005 1 , we give a definition of (causal) explana- 
tion using the definition of causality. An explanation adds information to an agent's knowledge; 
very roughly, an explanation of (/? is a minimal elaboration of events that suffice to cause Lp even 
in the face of uncertainty about the actual situation. 

The use of structural equations as a model for causal relationships is standard in the social 
sciences, and seems to go back to the work of Sewall Wright in the 1920s (see | Goldberger 1972 1 
for a discussion); the particular framework that we use here is due to Pearl II1995L and is fur- 
ther developed in IIGalles and Pearl 19971 [Halpem 2000llPearl 2()00ll . While it is hard to argue 
that our definition (or any other definition, for that matter) is the "right" definition, we show 
that it deals well with the difficulties that have plagued other approaches in the past, especially 
those exemplified by the rather extensive compendium of Hall and Paul II2003I . 

According to our definition, the truth of every claim must be evaluated relative to a par- 
ticular model of the world; that is, our definition allows us to claim only that C causes E in 
a (particular context in a) particular structural model. It is possible to construct two closely 
related structural models such that C causes E in one and C does not cause E in the other. 
Among other things, the modeler must decide which variables (events) to reason about and 
which to leave in the background. We view this as a feature of our model, not a bug. It moves 
the question of actual causality to the right arena — debating which of two (or more) models of 
the world is a better representation of those aspects of the world that one wishes to capture and 
reason about. This, indeed, is the type of debate that goes on in informal (and legal) arguments 
all the time. 

There has been extensive discussion about causality in the philosophy literature. To keep 
this paper to manageable length, we spend only minimal time describing other approaches and 
comparing ours with them. We refer the reader to IHall and Paul 20031 IPearl 20'00l Sosa and Tooley 1993t 
[Spirtes, Glymour, and Scheines 1993) for details and criticism of the probabilistic and logical 
approaches to causality in the philosophy literature. (We do try to point out where our defini- 
tion does better than perhaps the best-known approach, due to Lewis 119731 EUUni . as well as 
some other recent approaches IHall 2000UPaul 1998llYablo 20021 . in the course of discussing 
the examples.) 

There has also been work in the AI literature on causality. Perhaps the closest to this are 
papers by Pearl and his colleagues that use the structural-model approach. The definition of 
causality in this paper was inspired by an earlier paper of Pearl's II1998I that defined actual 
causality in terms of a construction called a causal beam. The definition was later modified 
somewhat (see UPearl 20001 Chapter 10]). The modifications were in fact largely due to the 
considerations addressed in this paper. The definition given here is more transparent and han- 
dles a number of cases better (see Example lA.31 in the appendix). 

Tian and Pearl 1120001 give results on estimating (from empirical data) the probability that 
C is a necessary cause of E — that is, the probability that E would not have occurred if C had 
not occurred. Necessary causality is related to but different from actual causality, as the defi- 
nitions should make clear. Other work (for example, HHeckerman and Shachter 19951 ) focuses 
on when a random variable X is the cause of a random variable Y\ by way of contrast, we 
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focus on when an event such as X = x causes an event such a.%Y = y. Considering when 
a random variable is the cause of another is perhaps more appropriate as a prospective notion 
of causality: could X potentially be a cause of changes in Y . Our notion is more appropriate 
for a retrospective notion of causality: given all the information relevant to a given scenario, 
was X = X the actual cause of F = y in that scenario? Many of the subtleties that arise when 
dealing with events simply disappear if we look at causality at the level of random variables. 
Finally, there is also a great deal of work in AI on formal action theory (see, for example, 
ILin 1995t ISandewall 1994t IReiter 20TJ11 '). which is concerned with the proper way of incor- 
porating causal relationships into a knowledge base so as to guide actions. The focus of our 
work is quite different; we are concerned with extracting the actual causality relation from such 
a knowledge base, coupled with a specific scenario. 

The best ways to judge the adequacy of an approach are the intuitive appeal of the defini- 
tions and how well it deals with examples; we believe that this paper shows that our approach 
fares well on both counts. 

The remainder of the paper is organized as follows. In the next section, we review structural 
models. In Section|3]we give a preliminary definition of actual causality and show in Section|4l 
how it deals with some examples of causality that have been problematic for other accounts. 
We refine the definition slightly in Section 13 and show how the refinement handles further 
examples. We conclude in Section |^ with some discussion. 



2 Causal Models: A Review 



In this section we review the basic definitions of causal models, as defined in terms of structural 
equations, and the syntax and semantics of a language for reasoning about causality. We also 
briefly compare our approach with the more standard approaches to modeling causality used 
in the literature. 



Causal Models: The description of causal models given here is taken from [ Halpem 2000| ; 
the reader is referred to IGalles and Pearl 19971 Halpem 2000[ IPearl 20(3UI for more details, 
motivation, and intuition. 

The basic picture here is that we are interested in the values of random variables. If X is 
a random variable, a typical event has the form X = x. (In terms of possible worlds, this just 
represents the set of possible worlds where X takes on value x, although the model does not 
describe the set of possible worlds.) Some random variables may have a causal influence on 
others. This influence is modeled by a set of structural equations. Each equation represents 
a distinct mechanism (or law) in the world, one that may be modified (by external actions) 
without altering the others. In practice, it seems useful to split the random variables into two 
sets, the exogenous variables, whose values are determined by factors outside the model, and 
the endogenous variables, whose values are ultimately determined by the exogenous variables. 
It is these endogenous variables whose values are described by the structural equations. 
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Formally, a signature 5 is a tuple {U, V, 71), where W is a set of exogenous variables, V is 
a set of endogenous variables, and TZ associates with every variable Y E U U V a nonempty 
set TZiY) of possible values for Y (that is, the set of values over which Y ranges). In most 
of this paper (except the appendix) we assume that V is finite. A causal model (or structural 
model) over signature 5 is a tuple M = (5, JF), where JF associates with each variable X eV 
a function denoted Fx such that Fx : {xu(,uT^{U)) x {xy(zv-{x}TZ{Y)) TZ{X). Fx 
determines the value of X given the values of all the other variables in W U V. For example, 
if FxiY, Z,U) = Y + U (which we usually write as X = Y + U), then if y = 3 and 
U = 2, then X = 5, regardless of how Z is set. These equations can be thought of as 
representing processes (or mechanisms) by which values are assigned to variables. Hence, like 
physical laws, they support a counterfactual interpretation. For example, the equation above 
claims that, in the context U = u,ifY were 4, then X would he u + A (which we write as 
(M, u) 1= [Y ^ 4:]{X = u + 4)), regardless of what values X, Y, and Z actually take in the 
real world. 

The function JF defines a set of (modifiable) structural equations, relating the values of 
the variables. Because Fx is a function, there is a unique value of X once we have set all 
the other variables. Notice that we have such functions only for the endogenous variables. 
The exogenous variables are taken as given; it is their effect on the endogenous variables (and 
the effect of the endogenous variables on each other) that we are modeling with the structural 
equations. 

The counterfactual interpretation and the causal asymmetry associated with the structural 
equations are best seen when we consider external interventions (or spontaneous changes), 
under which some equations in F are modified. An equation such as a; = Fx{u,y) should 
be thought of as saying that in a context where the exogenous variables have values u, if Y 
were set to y by some means (not specified in the model), then X would take on the value x, as 
dictated by Fx- The same does not hold when we intervene directly on X; such an intervention 
amounts to assigning a value to X by external means, thus overruling the assignment specified 
by Fx- In this case, Y is no longer committed to tracking X according to Fx- Variables on the 
left-hand side of equations are treated differently from ones on the right-hand side. 

For those more comfortable with thinking of counterfactuals in terms of possible worlds, 
this modification of equations may be given a simple "closest world" interpretation: the so- 
lution of the equations obtained by replacing the equation for Y with the equation Y = y, 
while leaving all other equations unaltered, gives the closest "world" to the actual world where 
Y = y. In this possible-world interpretation, the asymmetry embodied in the model says that 
if X = a; in the closest world to w where Y = y,it does not follow that Y = y in the closest 
worlds to lu where X = x. In terms of structural equations, this just says that if X = x is the 
solution for X under the intervention Y = y,it does not follow that Y = y is the solution for Y 
under the intervention X = x. Each of two interventions modifies the system of equations in 
a distinct way; the former modifies the equation in which Y stands on the left, while the latter 
modifies the equation in which X stands on the left. 

In summary, the equal sign in a structural equation differs from algebraic equality; in addi- 
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tion to describing an equality relationship between variables, it acts as an assignment statement 
in programming languages, since it specifies the way variables' values are determined. This 
should become clearer in our examples. 

Example 2.1: Suppose that we want to reason about a forest fire that could be caused by 
either lightning or a match lit by an arsonist. Then the causal model would have the following 
endogenous variables (and perhaps others): 

• F for fire (F = 1 if there is one, F = otherwise); 

• L for lightning (L = 1 if lightning occurred, L = otherwise); 

• ML for match lit (ML = 1 if the match was lit, ML = otherwise). 

The set U of exogenous variables includes conditions that suffice to render all relationships 
deterministic (such as whether the wood is dry, whether there is enough oxygen in the air for 
the match to light, etc.). Suppose that m is a setting of the exogenous variables that makes a 
forest fire possible (i.e., the wood is sufficiently dry, there is oxygen in the air, and so on). 
Then, for example, Fp{u, L,ML) is such that F = 1 if either L = 1 or ML = 1. Note that 
although the value of F depends on the values of L and ML, the value of L does not depend on 
the values of F and ML. | 

As we said, a causal model has the resources to determine counterfactual effects. Given a 
causal model M = (5, JF), a (possibly empty) vector X of variables in V, and vectors x and u 
of values for the variables in X and U, respectively, we can define a new causal model denoted 
M^^^ over the signature S-^ = (W, V — X, 7^|y_^).' M-^^^ is called a submodel of M by 
Pearl II2000I . Intuitively, this is the causal model that results when the variables in X are set to 
X by by some external action that affects only the variables in X; we do not model the action 
or its causes explicitly. Formally, M^^^ = (5^, JF^^^), where Fy^^ is obtained from Fy 
by setting the values of the variables in X to x. For example, if M is the structural model 
describing Example l2. 11 then the model Ml^q has the equation F = ML. The equation for F 
in Ml^o no longer involves L; rather, it is determined by setting L to in the equation for F 
in M. Moreover, there is no equation for L in M^^q. 

It may seem strange that we are trying to understand causality using causal models, which 
clearly already encode causal relationships. Our reasoning is not circular. Our aim is not 
to reduce causation to noncausal concepts, but to interpret questions about causes of specific 
events in fully specified scenarios in terms of generic causal knowledge such as what we obtain 
from the equations of physics. The causal models encode background knowledge about the 
tendency of certain event types to cause other event types (such as the fact that lightning can 
cause forest fires). We use the models to determine the causes of single (or token) events, such 

'We are implicitly identifying the vector X with the subset of V consisting of the variables in X. 'R■\-^;_x is 
the restriction of TZ to the variables inV — X. 
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as whether it was arson that caused the fire of June 10, 2000, given what is known or assumed 
about that particular fire. 

Notice that, in general, there may not be a unique vector of values that simultaneously 
satisfies the equations in M f^^'-. indeed, there may not be a solution at all. For simplicity in 
this paper, we restrict attention to what are called recursive (or acyclic) equations. This is the 
special case where there is some total ordering -< of the variables in V such that if X -< y, 
then Fx is independent of the value of Y; that is, Fx{- . . ,y, . . .) = Fx{. ..,?/',...) for all 
y,y' E TZ{Y). Intuitively, if a theory is recursive, there is no feedback. If X ~< Y, then the 
value of X may effect the value of Y, but the value of Y has no effect on the value of X. We do 
not lose much generality by restricting to recursive models (that is, ones whose equations are 
recursive). As suggested in the latter half of Example 14.21 it is always possible to timestamp 
events to impose an ordering on variables and thus construct a recursive model corresponding 
to a story. In any case, in the appendix, we sketch the necessary modifications of our definitions 
to deal with nonrecursive models. 

It should be clear that if M is a recursive causal model, then there is always a unique 
solution to the equations in M^^^, given a setting u for the variables in U (we call such a 
setting u a context). We simply solve for the variables in the order given by ^. 

We can describe (some salient features of) a causal model M using a causal network. This 
is a graph with nodes corresponding to the random variables in V and an edge from a node 
labeled X to one labeled Y if Fy depends on the value of X. This graph is a dag — a directed, 
acyclic graph (that is, a graph with no cycle of directed edges). The acyclicity follows from the 
assumption that the equations are recursive. Intuitively, variables can have a causal effect only 
on their descendants in the causal network; if Y is not a descendant of X, then a change in the 
value of X has no affect on the value of Y. For example, the causal network for Example |2. II 
has the following form: 



U 




Figure 1 : A simple causal network. 

We remark that we occasionally omit the exogenous variables U from the causal network. 

These causal networks, which are similar in spirit to the Bayesian networks used to repre- 
sent and reason about dependences in probability distributions UPearl 19881 . will play a signifi- 
cant role in our definitions. They are quite similar in spirit to Lewis's II1973I neuron diagrams, 
but there are significant differences as well. Roughly speaking, neuron diagrams display ex- 
plicitly the functional relationships (among variables in V) for each specific context u. The 
class of functions represented by neuron diagrams is limited to those described by "stimula- 
tory" and "inhibitory" binary inputs. Causal networks represent arbitrary functional relation- 
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ships, although the exact nature of the functions is specified in the structural equations and 
is not encoded in the diagram. The structural equations carry all the information we need to 
do causal reasoning, including all the information about belief, causation, intervention, and 
counterfactual behavior. 

As we shall see, there are many nontrivial decisions to be made when choosing the struc- 
tural model. One significant decision is the set of variables used. As we shall see, the events 
that can be causes and those that can be caused are expressed in terms of these variables, as are 
all the intermediate events. By way of contrast, in the philosophy literature, these events can 
be created on the fly, as it were. We return to this point in our examples. 

Once the set of variables is chosen, it must be decided which are exogenous and which 
are endogenous. The exogenous variables to some extent encode the background situation, 
which we wish to take for granted. Other implicit background assumptions are encoded in 
the structural equations themselves. Suppose that we are trying to decide whether a lightning 
bolt or a match was the cause of the forest fire, and we want to take for granted that there is 
sufficient oxygen in the air and the wood is dry. We could model the dryness of the wood by an 
exogenous variable D with values (the wood is wet) and 1 (the wood is dry).^ By making D 
exogenous, its value is assumed to be given and out of the control of the modeler. We could also 
take the amount of oxygen as an exogenous variable (for example, there could be a variable 
O with two values — 0, for insufficient oxygen, and 1, for sufficient oxygen); alternatively, we 
could choose not to model oxygen explicitly at all. For example, suppose we have, as before, 
a random variable ML for match lit, and another variable WB for wood burning, with values 
(it's not) and 1 (it is). The structural equation Fwb would describe the dependence of WB on 
D and ML. By setting Fwb{^, 1) = 1, we are saying that the wood will bum if the match is 
lit and the wood is dry. Thus, the equation is implicitly modeling our assumption that there is 
sufficient oxygen for the wood to burn. 

We remark that, according to the definition in Section only endogenous variables can be 
causes or be caused. Thus, if no variables encode the presence of oxygen, or if it is encoded 
only in an exogenous variable, then oxygen cannot be a cause of the wood burning. If we were 
to explicitly model the amount of oxygen in the air (which certainly might be relevant if we 
were analyzing fires on Mount Everest), then Fwb would also take values of O as an argument, 
and the presence of sufficient oxygen might well be a cause of the wood burning.^ 

Besides encoding some of our implicit assumptions, the structural equations can be viewed 
as encoding the causal mechanisms at work. Changing the underlying causal mechanism can 
affect what counts as a cause. Section HI provides several examples of the importance of the 
choice of random variables and the choice of causal mechanism. It is not always straightfor- 
ward to decide what the "right" causal model is in a given situation, nor is it always obvious 
which of two causal models is "better" in some sense. These may be difficult decisions and 

^Of course, in practice, we may want to allow D to have more values, indicating the degree of dryness of the 
wood, but that level of complexity is unnecessary for the points we are trying to make here. 

^If there are other variables in the model, these would be arguments to Fwb as well; we have ignored other 
variables here just to make our point. 
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often lie at the heart of determining actual causality in the real world. Nevertheless, we believe 
that the tools we provide here should help in making principled decisions about those choices. 

Syntax and Semantics: To make the definition of actual causality precise, it is helpful to 
have a logic with a formal syntax. Given a signature S = {U, V,TZ), a formula of the form 
X = X, for X E V and x G 71{X), is called a primitive event. A basic causal formula (over 
iSj is one of the form [Yi ^ yi, . . . , ^ Uk]^, where 

• (y9 is a Boolean combination of primitive events, 

• Fi, . . . , Yfc are distinct variables in V, and 

• e 7^(y,)• 

Such a formula is abbreviated as \Y ^ y\ip. The special case where = is abbreviated as ip. 
Intuitively, [Fi ^ . . . , 1^ ^ says that Lp holds in the counterfactual world that would 
arise if Yi were set to i = 1, . . . , /c. A causal formula is a Boolean combination of basic 
causal formulas."^ 

A causal formula iIj is true or false in a causal model, given a context. We write (M, u) \= 
-0 if -0 is true in causal model M given context u? {M,u) \= [Y ^ y\{X = x) if the 
variable X has value x in the unique (since we are dealing with recursive models) solution 
to the equations in M^^g in context u (that is, the unique vector of values for the exogenous 

variables that simultaneously satisfies all equations fJ^^, Z — Y , with the variables in U 
set to ti). {M,u) \= [Y y\ip for an arbitrary Boolean combination ip of formulas of the form 
X = X is defined similarly. We extend the definition to arbitrary causal formulas, i.e.. Boolean 
combinations of basic causal formulas, in the obvious way. 

Note that the structural equations are deterministic. We can make sense out of probabilistic 
counterfactual statements, even conditional ones (the probability that X would be 3 if Yi were 
2, given that Y is in fact 1) in this framework (see HBalke and Pearl 19941 ). by putting a proba- 
bility on the set of possible contexts. This will not be necessary for our discussion of causality, 
although it will play a more significant role in the discussion of explanation. 

3 The Definition of Cause 

With all this notation in hand, we can now give a preliminary version of the definition of actual 
cause ("cause" for short). We want to make sense out of statements of the form "event A is 

^If we write for conditional implication, then a formula such as [Y ^ y](p can be written as Y ~ y ^ (p: 
if Y were y, then Lp would hold. We use the present notation to emphasize the fact that, although we are viewing 
y ^ 1/ as a modal operator, we are not giving semantics using the standard possible worlds approach. 

^We remark that in IGa lles and Pearl 1997 Halpern 2000J , the context u does not appear on the left-hand 
side of |=; rather, it is incorporated in the formula ip on the right-hand side (so that a basic formula becomes 
X{u) = x). Additionally, Pearl f20001 abbreviated {M, u) ^ [Y ^ y\{X ~ x) as Xy{u) = x. The presentation 
here makes certain things more exphcit, although they are technically equivalent. 
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an actual cause of event Lp (in context u)'".^ As we said earlier, the context is the background 
information. While this has been left implicit in some treatments of causality, we find it useful 
to make it explicit. The picture here is that the context (and the structural equations) are given. 
Intuitively, they encode the background knowledge. All the relevant events are known. The 
only question is picking out which of them are the causes of or, alternatively, testing whether 
a given set of events can be considered the cause of Lp? 

The types of events that we allow as actual causes are ones of the form Xi = xi/\. . ./\Xk = 
Xk — that is, conjunctions of primitive events; we typically abbreviate this as X = x. The 
events that can be caused are arbitrary Boolean combinations of primitive events. We might 
consider generalizing further to allow disjunctive causes. We do not believe that we lose much 
by disallowing disjunctive causes here. Since for causality we are assuming that the structural 
model and all the relevant facts are known, the only reasonable definition of ''A or B causes 
if" seems to be that "either A causes (p or B causes (/?". There are no truly disjunctive causes 
once all the relevant facts are known. ^ 

Definition 3.1: (Actual cause; preliminary version) X = a; is an actual cause ofip in (M, u) if 
the following three conditions hold. 

ACl. (M, u) 1= {X = x) A ip. (That is, both X = x and ip are true in the actual world.) 

AC2. There exists a partition {Z,W) of V with X C Z and some setting {x',w') of the 
variables in {X , W) such that if (Af, u) \= Z = z* for all Z e Z, then both of the 
following conditions hold: 

(a) {M,u) 1= [X ^ x',W w']^(p. In words, changing {X,W) from {x,w) to 

(x', w') changes ip from true to false. 

(b) (M, u) 1= [X ^ x,W' ^ w\ Z' ^ z']p) for all subsets W' of W and all subsets 

Z' of Z. In words, setting any subset of variables in W to their values in w' should 
have no effect on Lp, as long as X is kept at its current value x, even if all the 
variables in an arbitrary subset of Z are set to their original values in the context u. 

AC3. X is minimal; no subset of X satisfies conditions ACl and AC2. Minimality ensures 
that only those elements of the conjunction X = x that are essential for changing ip in 
AC2(a) are considered part of a cause; inessential elements are pruned. | 

^Note that we are using the word "event" here in the standard sense of "set of possible worlds" (as opposed to 
"transition between states of affairs"); essentially we are identifying events with propositions. 

^We use both past tense and present tense in our examples ("was the cause" versus "is the cause"), with the 
usage depending on whether the scenario implied by the context u is perceived to have taken place in the past or 
to persist through the present. 

^Having said that, see the end of Example 13.21 for further discussion of this issue. Disjunctive explanations 
seem more interesting, although we cannot handle them well in our framework; these are discussed in Part II. 
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Although we have labeled this definition "preliminary", it is actually very close to the 
final definition. We discuss the final definition in Section |31 after we have considered a few 
examples. 

The core of this definition lies in AC2. Informally, the variables in Z should be thought of 
as describing the "active causal process" from X to </? (also called "intrinsic process" by Lewis 
119861 Appendix D]).^ These are the variables that mediate between X and Indeed, we can 
define an active causal process from X = x to as a minimal set Z that satisfies AC2. We 
would expect that the variables in an active causal process are all on a path from a variable in X 
to a variable in y?. This is indeed the case. Moreover, it can easily be shown that the variables in 
an active causal process all change their values when (X, W) is set to (x', w') as in AC2. Any 
variable that does not change in this transition can be moved to W , while retaining its value in 
w' — the remaining variables in Z will still satisfy AC2. (See the appendix for a formal proof.) 
AC2(a) says that there exists a setting x' of X that changes to -k/?, as long as the variables not 
involved in the causal process (1^) take on value w' . AC2(a) is reminiscent of the traditional 
counterfactual criterion of Lewis II1973I . according to which would be false if it were not 
for X being x. However, AC2(a) is more permissive than the traditional criterion; it allows the 
dependence of (/? on X to be tested under special circumstances in which the variables W are 
held constant at some setting w' . This modification of the traditional criterion was proposed 
by Pearl 1119981 120001 and was named structural contingency — an alteration of the model M 
that involves the breakdown of some mechanisms (possibly emerging from external action) 
but no change in the context u. The need to invoke such contingencies will be made clear in 
Example l3.21 and is further supported by the examples of Hitchcock 1120011 . 

AC2(b), which has no obvious analogue in the literature, is an attempt to counteract the 
"permissiveness" of AC2(a) with regard to structural contingencies. Essentially, it ensures that 
X alone suffices to bring about the change from (/? to -19?; setting W to w' merely eliminates 
spurious side effects that tend to mask the action of X. It captures the fact that setting W 
to w' does not affect the causal process by requiring that changing the values of any subset 
of the variables in W from w to w' has no effect on the value of Moreover, although 
the values in the variables Z involved in the causal process may be perturbed by the change, 
the perturbation has no impact on the value of (/?. The upshot of this requirement is that we 
are not at liberty to conduct the counterfactual test of AC2(a) under an arbitrary alteration 
of the model. The alteration considered must not affect the causal process. Clearly, if the 
contingencies considered are limited to "freezing" variables at their actual value (a restriction 
used by Hitchcock 1120011 ). so that (M, u)^W = w' , then AC2(b) is satisfied automatically. 
However, as the examples below show, genuine causation may sometimes be revealed only 
through a broader class of counterfactual tests in which variables in W are set to values that 
differ from their actual values. 

'Recently, Lewis 120001 has abandoned attempts to define "intrinsic process" formally. Pearl's "causal beam" 
IPearl 20001 p. 318] is a special kind of active causal process, in which AC2(b) is expected to hold (with Z = z*) 
for all settings w" of W , not necessarily the setting w' used in AC2(a). 

This version of AC2(b) differs slightly from that in an earlier version of this paper IHalpern and Pearl 2001| . 
See Appendix lA.2l for more discussion of this issue. 



10 



Pearl II2000I defines a notion of contributory cause in addition to actual cause. Roughly 
speaking, if AC2(a) holds only with W = w' ^ w, then X = x is a contributory cause of ip; 
actual causality holds only ifW = w. Interestingly, in all our examples in Section HI changing 
W from w to w' has no impact on the value of the variables in Z. That is, (M, n) |= [W ^ 
w'\{Z = z*) for all Z E Z. Thus, to check AC2(b) in these examples, it suffices to show that 
(M, u) \= [X ^ x,W ^ w']ip. We provide an example in the appendix to show that there are 
cases where the variables in Z can change value, so the full strength of AC2(b) is necessary. 

We remark that, like the definition here, the causal beam definition UPearl 20001 tests for 
the existence of counterfactual dependency in an auxiliary model of the world, modified by 
a select set of structural contingencies. However, whereas the contingencies selected by the 
beam criterion depend only on the relationship between a variable and its parents in the causal 
diagram, the current definition selects the modifying contingencies based on the specific cause 
and effect pair being tested. This refinement permits our definition to avoid certain pitfalls 
(see Example lA. 31) that are associated with graphical criteria for actual causation. In addition, 
the causal beam definition essentially adds another clause to AC2, placing even more stringent 
requirements on causality. Specifically, it requires 

AC2(c). {M, u) ^ [X ^ x,W ^ w"]ip for all settings w" of W. 

AC2(c) says that setting X to x is enough to force </? to hold, independent of the setting of W}^ 
We say that X = x strongly causes ip if AC2(c) holds in addition to all the other conditions. 
As we shall see, in many of our examples, causality and strong causality coincide. In the cases 
where they do not coincide, our intuitions suggest that strong causality is too strong a notion. 

ACS is a minimality condition. Heckerman and Shachter II1995I have a similar minimality 
requirement; Lewis II2000I mentions the need for minimality as well. Interestingly, in all the 
examples we have considered, ACS forces the cause to be a single conjunct of the form X = x. 
Although it is far from obvious, Eiter and Lukasiewicz II2002I and, independently, Hopkins 
11200 II . have shown that this is in fact a consequence of our definition. However, it depends 
crucially on our assumption that the set V of endogenous variables is finite; see the appendix 
for further discussion of this issue. As we shall see, it also depends on the fact that we are 
using causality rather than strong causality. 

How reasonable are these requirements? One issue that some might find inappropriate is 
that we allow X = a; to be a cause of itself. While we do not find such trivial causality terribly 
bothersome, it can be avoided by requiring that X = x A -^(p be consistent for X = x to be a 
cause of ip. More significantly, is it appropriate to invoke structural changes in the definition 
of actual causation? The following example may help illustrate why we believe it is. 

Example 3.2: Suppose that two arsonists drop lit matches in different parts of a dry forest, and 
both cause trees to start burning. Consider two scenarios. In the first, called the disjunctive 
scenario, either match by itself suffices to bum down the whole forest. That is, even if only 

'^Pearl 120001 calls this invariance sustenance. 
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one match were lit, the forest would burn down. In the second scenario, called the conjunctive 
scenario, both matches are necessary to burn down the forest; if only one match were lit, the 
fire would die down before the forest was consumed. We can describe the essential structure 
of these two scenarios using a causal model with four variables: 

• an exogenous variable U that determines, among other things, the motivation and state 
of mind of the arsonists. For simplicity, assume that 71(11) = {mqo, ^lo, itoi, ^n}; if 
U = Uij, then the first arsonist intends to start a fire iff i = 1 and the second arsonist 
intends to start a fire iff j = 1. In both scenarios U = uu. 

• endogenous variables MLi and ML2, each either or 1, where MLi = if arsonist i 
doesn't drop the lit match and MLi = 1 if he does, for i = 1,2. 

• an endogenous variable FB for forest bums down, with values (it doesn't) and 1 (it 
does). 

Both scenarios have the same causal network (see Figure|2l); they differ only in the equation for 
FB. For the disjunctive scenario we have Ffb{u, 1,1) = Ffb{u, 0, 1) = Ffb{u, 1, 0) = 1 and 
Ffb{u, 0, 0) = (where u E Tl{U)y, for the conjunctive scenario we have Ffb{u, 1,1) = 1 
and Ffb{u, 0,0) = Ffb{u, 1,0) = Ffb{u,0, 1) = 0. In general, we expect that the causal 
model for reasoning about forest fires would involve many other variables; in particular, vari- 
ables for other potential causes of forest fires such lightning and unattended campfires; here we 
focus on that part of the causal model that involves forest fires started by arsonists. Since for 
causality we assume that all the relevant facts are given, we can assume here that it is known 
that there were no unattended campfires and there was no lightning, which makes it safe to ig- 
nore that portion of the causal model. Denote by Mi and M2 the (portion of the) causal models 
associated with the disjunctive and conjunctive scenarios, respectively. The causal network for 
the relevant portion of Mi and M2 is described in Figure |2l 



U 




Figure 2: The causal network for Mi and M2. 



Despite the differences in the underlying models, each of MLi = 1 and ML2 = 1 is a 
cause of FB = 1 in both scenarios. We present the argument for MLi = 1 here. To show 
that MLi = 1 is a cause in Mi let Z = {MLi,FB}, so = {ML2}. It is easy to see that 
the contingency ML2 = satisfies the two conditions in AC2. AC2(a) is satisfied because, in 
the absence of the second arsonist {ML2 = 0), the first arsonist is necessary and sufficient for 
the fire to occur (FB = 1). AC2(b) is satisfied because, if the first match is lit (MLi = 1) the 
contingency ML2 = does not prevent the fire from burning the forest. Thus, MLi = 1 is a 
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cause of FB = 1 in Mi . (Note that we needed to set ML2 to 0, contrary to fact, in order to 
reveal the latent dependence of FB on MLi. Such a setting constitutes a structural change in 
the original model, since it involves the removal of some structural equations.) 

To see that MLi = 1 is also a cause of FB = 1 in M2, again let Z = {MLi,FB} and 
W = {ML2}. Since (M2,Wii) h [MLi ^ 0,ML2 ^ 1]{FB = 0), AC2(a) is satisfied. 
Moreover, since the value of ML2 required for AC2(a) is the same as its current value (i.e., 
w' = w), AC2(b) is satisfied trivially. 

This example also illustrates the need for the minimality condition ACS. For example, if 
lighting a match qualifies as the cause of fire then lighting a match and sneezing would also 
pass the tests of ACl and AC2 and awkwardly qualify as the cause of fire. Minimality serves 
here to strip "sneezing" and other irrelevant, over-specific details from the cause. 

It might be argued that allowing disjunctive causes would be useful in this case to distin- 
guish Ml from M2 as far as causality goes. A purely counterfactual definition of causality 
would make MLi = 1 V ML2 = 1 a cause of F5 = 1 in Mi (since, if MLi = 1 V ML2 = 1 
were not true, then FB = 1 would not be true), but would make neither MLi = 1 nor ML2 = 1 
individually a cause (since, for example, if MLi = 1 were not true in Mi, FB = 1 would 
still be true). Clearly, our definition does not enforce this intuition. As is well known (and 
as the examples in Section HI show) purely counterfactual definitions of causality have other 
problems. We do not have a strong intuition as to the best way to deal with disjunction in the 
context of causality, and believe that disallowing it is reasonably consistent with intuitions. 

This example shows that causality and strong causality do not always coincide. It is not 
hard to check that MLi and ML2 are strong causes of FB in both scenarios. However, for MLi 
to be a strong cause of FB in the conjunctive scenario, we must include ML2 in Z (so that W is 
empty); if ML2 is in W, then AC2(c) fails. Thus, with strong causality, it is no longer the case 
that we can take Z to consist only of variables on a path between the cause (MLi = 1 in this 
case) and the effect (FB =1). 

Moreover, suppose that we change the disjunctive scenario slightly by allowing either ar- 
sonist to have guilt feelings and call the fire department. If one arsonist calls the fire depart- 
ment, then the forest is saved, no matter what the other arsonist does. We can model this by 
allowing MLi and ML2 to have a value of 2 (where MLi = 2 if arsonist i calls the fire de- 
partment). If either is 2, then FB = 0. In this situation, it is easy to check that now neither 
MLi = 1 nor ML2 = 1 by itself is a strong cause of FB = 1 in the disjunctive scenario. 
MLi = 1 A ML2 = 1 is a cause, but it seems strange that in the disjunctive scenario, we should 
need to take both arsonists dropping a lit match to (strongly) cause the fire, just because we 
allow for the possibility that an arsonist can call the fire department. Note that this also shows 
that, in general, strong causes are not always single conjuncts. | 

This is a good place to illustrate the need for structural contingencies in the analysis of 
actual causation. The reason we consider MLi = 1 to be a cause of FB = 1 in Mi is that if 
ML2 had been 0, rather than 1, FB would depend on MLi. In words, we imagine a situation 
in which the second match is not lit, and we then reason counterfactually that the forest would 
not have burned down if it were not for the first match. 



13 



Although MLi = 1 is a cause of FB = 1 in both the disjunctive and conjunctive scenarios, 
the models Mi and M2 differ in regard to explanation, as we shall see in Part II of this paper. In 
the disjunctive scenario, the lighting of one of the matches constitutes a reasonable explanation 
of the forest burning down; not so in the conjunctive scenario. Intuitively, we feel that if both 
matches are needed for establishing a forest fire, then both MLi = 1 and ML2 = 1 together 
would be required to fully explain the unfortunate fate of the forest; pointing to just one of 
these events would only beg another "How come?" question, and would not stop any serious 
investigating team from continuing its search for a more complete answer. 

Finally, a remark concerning a contrastive extension to the definition of cause. When seek- 
ing a cause of Lp, we are often not just interested the occurrence versus nonoccurrence of tp, 
but also the manner in which 99 occurred, as opposed to some alternative way in which Lp could 
have occurred HHitchcock 19961 . We say, for example, "X = x caused a fire in June as op- 
posed to a fire in May." If we assume that there is only enough wood in the forest for one forest 
fire, the two contrasted events, "fire in May" and "fire in June", exclude but do not comple- 
ment each other (e.g., neither rules out a fire in April.) Definition l3.1l can easily be extended to 
accommodate contrastive causation. We define "x caused Lp, as opposed to (/?'", where ip and 
Lp' are incompatible but not exhaustive, by simply replacing -k/? with Lp' in condition AC2(a) of 
the definition. 

Contrast can also be applied to the antecedent, as in "Susan's running rather than walking 
to music class caused her fall." There are actually two interpretations of this statement. The 
first is that Susan's running is a cause of her falling; moreover, had she walked, then she would 
not have fallen. The second is that, while Susan's running is a cause of her falling, Susan's 
walking also would have caused her to fall, but she did not in fact walk. We can capture both 
interpretations of "X = x, rather than X = x' for some value x' ^ x, caused Lp (in context n in 
structure Af)". The first is (1) X = x is a cause of Lp in (M, u) and (2) (M, u) \= [X ^ x']^Lp; 
the second is (1') X = x is a cause of Lp in (M, u) and (2') AC2(b) holds for X = x' and Lp. That 
is, the only reason that X = x' is not the cause of Lp is that X = x' is not in fact what happened 
in the actual world. (More generally, we can make sense of "X = x rather than Y = y caused 
</?".) Contrasting both the antecedent and the consequent components is straightforward, and 
allows us to interpret sentences of the form: "Susan's running rather than walking to music 
class caused her to spend the night in the hospital, as opposed to her boyfriend's apartment." 



4 Examples 

In this section we show how our definition of actual causality handles some examples that have 
caused problems for other definitions. 



Example 4.1: The first example is due to Bennett (and appears in [ Sosa and Tooley 1993[ 



'^As Christopher Hitchcock [private communication, 2000] has pointed out, one of the roles of such contrastive 
statements is to indicate that TZ{X), the set of possible values of X, should include x' . The sentence does not 
make sense without this assumption. 
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pp. 222-223]). Suppose that there was a heavy rain in April and electrical storms in the fol- 
lowing two months; and in June the lightning took hold. If it hadn't been for the heavy rain in 
April, the forest would have caught fire in May. The question is whether the April rains caused 
the forest fire. According to a naive counterfactual analysis, they do, since if it hadn't rained, 
there wouldn't have been a forest fire in June. Bennett says "That is unacceptable. A good 
enough story of events and of causation might give us reason to accept some things that seem 
intuitively to be false, but no theory should persuade us that delaying a forest's burning for a 
month (or indeed a minute) is causing a forest fire." 

In our framework, as we now show, it is indeed false to say that the April rains caused 
the fire, but they were a cause of there being a fire in June, as opposed to May. This seems 
to us intuitively right. To capture the situation, it suffices to use a simple model with three 
endogenous random variables: 

• AS for "April showers", with two values — standing for did not rain heavily in April and 
1 standing for rained heavily in April; 

• ES for "electric storms", with four possible values: (0, 0) (no electric storms in either 
May or June), (1,0) (electric storms in May but not June), (0,1) (storms in June but not 
May), and (1,1) (storms in both May and June); 

• and F for "fire", with three possible values: (no fire at all), 1 (fire in May), or 2 (fire in 
June). 

We do not describe the context explicitly, either here or in the other examples. Assume its 
value u is such that it ensures that there is a shower in April, there are electric storms in both 
May and June, there is sufficient oxygen, there are no other potential causes of fire (such as 
dropped matches), no other inhibitors of fire (alert campers setting up a bucket brigade), and 
so on. That is, we choose u so as to allow us to focus on the issue at hand and to ensure that 
the right things happened (there was both fire and rain). 

We will not bother writing out the details of the structural equations — they should be obvi- 
ous, given the story (at least, for the context u); this is also the case for all the other examples 
in this section. The causal network is simple: there are edges from AS to F and from ES to F. 
It is easy to check that each of the following holds. 

• A5 = 1 is a cause of the June fire (F = 2) (taking W = {ES} and Z = {AS, F}) but not 
of fire (F = 2 V F = 1). That is, April showers are not a cause of the fire, but they are a 
cause of the June fire. 

• ES = (1, 1) is a cause of both F = 2 and (F = 1 V F = 2). Having electric storms in 
both May and June caused there to be a fire. 

• AS = 1 A ES = (1, 1) is not a cause of F = 2, because it violates the minimality 
requirement of ACS; each conjunct alone is a cause of F = 2. Similarly, AS = 1 AES = 
(1, 1) is not a cause of (F = 1 V F = 2). 
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Although we did not describe the context explicitly in Example |4. 11 it still played a crucial 
role. If we decide that the presence of oxygen is relevant then we must take this factor out of the 
context and introduce it as an explicit endogenous variables. Doing so can affect the causality 
picture (see Example 14.31) . The next example already shows the importance of choosing an 
appropriate granularity in modeling the causal process and its structure. 

Example 4.2: The following story from IHall 20041 is an example of preemption, where there 
are two potential causes of an event, one of which preempts the other. An adequate definition 
of causality must deal with preemption in all of its guises. 

Suzy and Billy both pick up rocks and throw them at a bottle. Suzy's rock gets 
there first, shattering the bottle. Since both throws are perfectly accurate, Billy's 
would have shattered the bottle had it not been preempted by Suzy's throw. 

Common sense suggests that Suzy's throw is the cause of the shattering, but Billy's is not. 
This holds in our framework too, but only if we model the story appropriately. Consider first a 
coarse causal model, with three endogenous variables: 

• ST for "Suzy throws", with values (Suzy does not throw) and 1 (she does); 

• BT for "Billy throws", with values (he doesn't) and 1 (he does); 

• BS for "bottle shatters', with values (it doesn't shatter) and 1 (it does). 

Again, we have a simple causal network, with edges from both 57 and BT to BS. In this simple 
causal network, BT and ST play absolutely symmetric roles, with BS = ST y BT, there is 
nothing to distinguish BT from ST. Not surprisingly, both Billy's throw and Suzy's throw are 
classified as causes of the bottle shattering in this model. 

The trouble with this model is that it cannot distinguish the case where both rocks hit the 
bottle simultaneously (in which case it would be reasonable to say that both ST = 1 and BT = 1 
are causes of BS = 1) from the case where Suzy's rock hits first. The model has to be refined 
to express this distinction. One way is to invoke a dynamic model HPearl 20001 p. 326]; this 
is discussed below. A perhaps simpler way to gain expressiveness is to allow BS to be three 
valued, with values (the bottle doesn't shatter), 1 (it shatters as a result of being hit by Suzy's 
rock), and 2 (it shatters as a result of being hit by Billy's rock). We leave it to the reader to 
check that ST = 1 is a cause of BS = 1, but BT = 1 is not (if Suzy hadn't thrown but Billy had, 
then we would have BS = 2). Thus, to some extent, this solves our problem. But it borders on 
cheating; the answer is almost programmed into the model by invoking the relation "as a result 
of", which requires the identification of the actual cause. 

A more useful choice is to add two new random variables to the model: 



16 



• BH for "Billy's rock hits the (intact) bottle", with values (it doesn't) and 1 (it does); 
and 



• SH for "Suzy's rock hits the bottle", again with values and 1. 

With this addition, we can go back to BS being two-valued. In this model, we have the causal 
network shown in FigureQl with the arrow SH BH being inhibitory; BH = BT A -^SH (that 
is, BH = 1 iff BT = 1 and SH = 0). Note that, to simplify the presentation, we have omitted the 
exogenous variables from the causal network in Figure |3l we do so in some of the subsequent 
figures as well. In addition, we have given the arrows only for the particular context of interest, 
where Suzy throws first. In a context where Billy throws first, the arrow would go from BH to 
SH rather than going from SH to BH, as it does in the figure. 

ST ^ "^^^ 

i J^BS 
BT '^BH^ 



Figure 3: The rock-throwing example. 

— * 

Now it is the case that Sr = 1 is a cause of BS = 1. To satisfy AC2, we choose W = {BT} 
and w' = and note that, because BT is set to 0, BS will track the setting of ST. Also note that 
BT = 1 is not a cause of 55 = 1; there is no partition ZUW that satisfies AC2. Attempting the 
symmetric choice W = {ST} and w' = would violate AC2(b) (with Z' = {BH}), because 
becomes false when we set ST = and restore BH to its current value of 0. 

This example illustrates the need for invoking subsets of Z in AC2(b). (Additional reasons 
are provided in Example I A. 3 1 in the appendix.) (M, u) \= [X ^ x,W ^ w']ip holds if we 
take Z = {BT,BH} and W = {ST, SH}, and thus without the requirement that AC2(b) hold 
for all subsets of Z, BT = 1 would have qualified as a cause of 55 = 1. Insisting that ip 
remains unchanged when both W is set to w' and Z' is set to z* (for an arbitrary subset Z' of 
Z) prevents us from choosing contingencies W that interfere with the active causal paths from 
X to Lp. 

This example also emphasizes an important moral. If we want to argue in a case of preemp- 
tion that X = xis the cause of ip rather than Y = y, then there must be a random variable {BH 
in this case) that takes on different values depending on whether X = x orY = y is the actual 
cause. If the model does not contain such a variable, then it will not be possible to determine 
which one is in fact the cause. This is certainly consistent with intuition and the way we present 
evidence. If we want to argue (say, in a court of law) that it was X's shot that killed C rather 
than y s, then we present evidence such as the bullet entering C from the left side (rather than 
the right side, which is how it would have entered had Y's shot been the lethal one). The side 
from which the shot entered is the relevant random variable in this case. Note that the random 
variable may involve temporal evidence (if Y's shot had been the lethal one, the death would 
have occurred a few seconds later), but it certainly does not have to. This is indeed the rationale 
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for Lewis's 119731 criterion of causation in terms of a counterfactual-dependence chain. We 
shall see, however, that our definition goes beyond this criterion. 

It may be argued, of course, that by introducing the intermediate variables SH and BH in 
Hall's story we have also programmed the desired answer into the problem; after all, it is the 
shattering of the bottle, not SH, which prevents BH. Pearl [i2000t Section 10.3.5] analyzes a 
similar late-preemption problem in a dynamic structural equation model, where variables are 
time indexed, and shows that the selection of the first action as an actual cause of the effect 
follows from conditions (similar to) AC1-AC3 even without specifying the owner of the hitting 
ball. We now present a simplified adaptation of this analysis. 

Let ti,t2, and stand, respectively, for the time that Suzy threw her rock, the time that Billy 
threw his rock, and the time that the bottle was found shattered. Let Hi and BSi be variables 
indicating whether the bottle is hit (Hi) and was shattered (BSi) at time U (where i = 1, 2, 3 
and ti < ^2 < ts), with values 1 if hit (respectively, shattered), if not. Roughly speaking, 
if we let Ti be a variable representing "someone throws the ball at time tj" and take BSq to be 
vacuously false (i.e., always 0), then we would expect the following time-invariant equations 
to hold for all times U (not just ti, t2, and t^): 

H, = TiA^BSi^i 
BSi = BSi^i V Hi. 

That is, the bottle is hit at time U if someone throws the ball at time U and the bottle wasn't 
already shattered at time U. Similarly, the bottle is shattered at time U either if it was already 
shattered at time or it was hit at time U. 

Since in this case we consider only times ti, t2, and t^, we get the following structural 
equations, where we have left in the variable T3 to bring out the essential invariance: 

Hi = ST 

BSi = Hi 

H2 = BTA^BSi 

BS2 = BSiV H2 

5S3 = BS2y H^. 

The diagram associated with this model is shown in Figure |4| In addition to these generic 
equations, the story also specifies that the context is such that 

ST= 1,BT= 1,T3 = 0. 

The causal network in Figure lUdescribes the situation. 

It is not hard to show that ST = 1 is a cause of 5^3 = 1 (taking W = {BT} in AC2 and 
w' = 0). BT = 1 is not a cause of 5^3 = 1; it fails AC2(b) for every partition Z U W. To see 
this, note that to establish counterfactual dependence between BS3 and BT, we must assign H2 
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Figure 4: Time-invariant rock throwing. 



to Z, assign BSi to W, and impose the contingency BSi = 0. But this contingency violates 
condition AC2(b), since it results in = when we restore H2 to (its current value). 

Two features are worth emphasizing in this example. First, Suzy's throw is declared a 
cause of the outcome event 5^3 = 1 even though her throw did not hasten, delay, or change 
any property of that outcome. This can be made clearer by considering another outcome event, 
J4 = "Joe was unable to drink his favorite chocolate cocktail from that bottle on Tuesday night." 
Being a consequence of 5^3, J4 will also be classified as having been caused by Suzy's throw, 
not by Billy's, although J4 would have occurred at precisely the same time and in the same 
manner had Suzy not thrown the ball. This implies that hastening or delaying the outcome 
cannot be taken as the basic principle for deciding actual causation, a principle advocated by 
Paul ESM- 

Second, Suzy's throw is declared a cause of 5^3 = 1 even though there is no counterfactual 
dependence chain between the two (i.e., a chain ^ where each event is 

counterfactually dependent on its predecessor). The existence of such a chain was proposed 
by Lewis II1973I as a necessary criterion for causation in cases involving preemption.'^ In the 
actual context, 5^2 does not depend (counterfactually) on either BSi or on H2', the bottle would 
be shattered at time ^2 even if it were unshattered at time ti (since Billy's rock would have hit 
it), as well as if it were hit (miraculously) at time ^2- I 



Example 4.3: Can not performing an action be (part of) a cause? Consider the following story, 
again taken from (an early version of) IHall 20041 : 



Billy, having stayed out in the cold too long throwing rocks, contracts a serious 
but nonfatal disease. He is hospitalized and treated on Monday, so is fine Tuesday 
morning. 



But now suppose the doctor does not treat Billy on Monday. Is the doctor's omission to 
treat Billy a cause of Billy's being sick on Tuesday? It seems that it should be, and indeed it 
is according to our analysis. Suppose that u is the context where, among other things, Billy is 

'^Lewis 119861 Appendix D] later amended this criterion to deal with problematic cases similar to that presented 
her 
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sick on Monday and the situation is such that the doctor forgets to administer the medication 
Monday. (There is much more to the context u, as we shall shortly see.) It seems reasonable 
that the model should have two random variables: 

• MT for "Monday treatment", with values (the doctor does not treat Billy on Monday) 
and 1 (he does); and 

• BMC for "Billy's medical condition", with values (recovered) and 1 (still sick). 

Sure enough, in the obvious causal model, MT = is a cause of BMC = 1. 

This may seem somewhat disconcerting at first. Suppose there are 100 doctors in the hos- 
pital. Although only one of them was assigned to Billy (and he forgot to give medication), in 
principle, any of the other 99 doctors could have given Billy his medication. Is the fact that 
they didn't give him the medication also part of the cause of him still being sick on Tuesday? 

In the particular model that we have constructed, the other doctors' failure to give Billy 
his medication is not a cause, since we have no random variables to model the other doctors' 
actions, just as we had no random variable in Example 14. II to model the presence of oxygen. 
Their lack of action is part of the context. We factor it out because (quite reasonably) we want 
to focus on the actions of Billy's doctor. If we had included endogenous random variables 
corresponding to the other doctors, then they too would be causes of Billy's being sick on 
Tuesday. 

With this background, we continue with Hall's modification of the original story. 

Suppose that Monday's doctor is reliable, and administers the medicine first thing 
in the morning, so that Billy is fully recovered by Tuesday afternoon. Tuesday's 
doctor is also reliable, and would have treated Billy if Monday's doctor had failed 
to . . . And let us add a twist: one dose of medication is harmless, but two doses are 
lethal. 

Is the fact that Tuesday's doctor did not treat Billy the cause of him being alive (and recovered) 
on Wednesday morning? 

The causal model for this story is straightforward. There are three random variables: MT for 
Monday's treatment (1 if Billy was treated Monday; otherwise), TT for Tuesday's treatment 
(1 if Billy was treated Tuesday; otherwise), and BMC for Billy's medical condition (0 if Billy 
is fine both Tuesday morning and Wednesday morning; 1 if Billy is sick Tuesday morning, fine 
Wednesday morning; 2 if Billy is sick both Tuesday and Wednesday morning; 3 if Billy is fine 
Tuesday morning and dead Wednesday morning). We can then describe Billy's condition as a 
function of the four possible combinations of treatment/nontreatment on Monday and Tuesday. 

In the causal network corresponding to this causal model, shown in Figure |5l there is an 
edge from MT to TT, since whether the Tuesday treatment occurs depends on whether the 
Monday treatment occurs, and edges from both MT and TT to BMC, since Billy's medical 
condition depends on both treatments. 
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Figure 5: Billy's medical condition. 



In this causal model, it is true that MT = 1 is a cause of BMC = 0, as we would expect — 
because Billy is treated Monday, he is not treated on Tuesday morning, and thus recovers 
Wednesday morning. MT = 1 is also a cause of TT = 0, as we would expect, and 7T = is 
a cause of Billy's being alive (BMC = V BMC = 1 V BMC = 2). However, Mr = 1 is not 
a cause of Billy's being alive. It fails condition AC2(a): setting MT = still leads to Billy's 
being alive (with = 0). Note that it would not help to take W = {TT}. For if TT = 0, 
then Billy is alive no matter what MT is, while if 7T = 1, then Billy is dead when MT has its 
original value, so AC2(b) is violated (with Z' = 0). 

This shows that causality is not transitive, according to our definitions. Although MT = 1 
is a cause of rr = and 7T = is a cause of BMC = BMC = 1 V5MC = 2, = 1 is not 
a cause of BMC = V BMC = 1 V BMC = 2. Nor is causality closed under right weakening: 
Mr = 1 is a cause of BMC = 0, which logically implies BMC = V BMC = 1 V BMC = 2, 
which is not caused by MT =1.^"^ 

Hall 120001 12004II discusses the issue of transitivity of causality, and suggests that there 
is a tension between the desideratum that causality be transitive and the desideratum that we 
allow causality due to the failure of some event to occur. He goes on to suggest that there are 
actually two concepts of causation: one corresponding to counterfactual dependence and the 
other corresponding to "production", whereby A causes B if A helped to produce B. Causation 
by production is transitive; causation by dependence is not. 

Our definition certainly has some features of both counterfactual dependence and of production — 
AC2(a) captures some of the intuition of counterfactual dependence (if A hadn't happened then 
B wouldn't have happened ifW = w') and AC2(b) captures some of the features of production 
(A forced B to happen, even ifW = w'). Nevertheless, we do not require two separate notions 
to deal with these concerns. 

Moreover, whereas Hall attributes the failure of transitivity to a distinction between pres- 
ence and absence of events, according to our definition, the requirement of transitivity causes 
problems whether or not we allow causality due to the failure of some event to occur. It is easy 
enough to construct a story whose causal model has precisely the same formal structure as that 
above, except that TT = now means that the treatment was given and TT = 1 means it wasn't. 
(Billy starts a course of treatment on Monday which, if discontinued once started, is fatal . . . ) 

^^Lewis 120001 implicitly assumes right weakening in his defense of transitivity. For example, he says ". . . it is 
because of Black's move that Red's victory is caused one way rather than another. That means, I submit, that in 
each of these cases. Black's move did indeed cause Red's victory. Transitivity succeeds." But there is a critical 
(and, to us, unjustifiable) leap in this reasoning. As we akeady saw in Example 14. II the fact that April rains cause 
a fire in June does not mean that they cause the fire. 
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Again, we don't get transitivity, but now it is because an event occurred (the treatment was 
given), not because it failed to occur. 

Lewis Ill986ll2000ll insists that causality is transitive, partly to be able to deal with preemp- 
tion ULewis 198611 ■ As Hitchcock 11200 II points out, our account handles the standard examples 
of preemption without needing to invoke transitivity, which, as Lewis's own examples show, 
leads to counterintuitive conclusions. | 

Example 4.4 This example considers the problem of what Hall calls double prevention. Again, 
the story is taken from Hall II2004I : 

Suzy and Billy have grown up, just in time to get involved in World War IIL Suzy is 
piloting a bomber on a mission to blow up an enemy target, and Billy is piloting a 
fighter as her lone escort. Along comes an enemy fighter plane, piloted by Enemy. 
Sharp-eyed Billy spots Enemy, zooms in, pulls the trigger, and Enemy's plane 
goes down in flames. Suzy's mission is undisturbed, and the bombing takes place 
as planned. 

Does Billy deserve part of the cause for the success of the mission? After all, if he hadn't 
pulled the trigger. Enemy would have eluded him and shot down Suzy. Intuitively, it seems that 
the answer is yes, and the obvious causal model gives us this. Suppose we have the following 
random variables: 

• BPT for "Billy pulls trigger", with values (he doesn't) and 1 (he does); 

• LE for "Enemy eludes Billy", with values (he doesn't) and 1 (he does); 

• LSS for "Enemy shoots Suzy", with values (he doesn't) and 1 (he does); 

• S'Srfor "Suzy shoots target", with values (she doesn't) and 1 (she does); 

• TD for "target destroyed", with values (it isn't) and 1 (it is). 

The causal network corresponding to this model is just 

BPT LE-^ LSS - ► SST -> TD. 

In this model, BPT = 1 is a cause of TD = 1. Of course, SST = 1 is a cause of TD = 1 as 
well. It may be somewhat disconcerting to observe that BPT = 1 is also a cause of SST = 1. 
It seems strange to think of Billy being a cause of Suzy doing something she was planning to 
do all along. Part of the problem is that, according to our definition (and all other definitions 
of causality that we are aware of), if A enables B, then A is a cause of B. Arguably another 
part of the problem with BPT = 1 being a cause of SST = 1 and TD = 1 is that it seems to 
leave Suzy out of the picture altogether. We can bring Suzy more into the picture by having 
a random variable corresponding to Suzy's plan or intention. Suppose that we add a random 
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SPS 




BPT ► LE ► LSS ► SST ► TD 

Figure 6: Blowing up the target. 

variable SPS for "Suzy plans to shoot the target", with values (she doesn't) and 1 (she does). 
Assuming that Suzy shoots if she plans to, we then get the following causal network, where 
now SST depends on both LSS and SPS: 

In this case, it is easy to check that each of BPT = 1 and SPS = 1 is a cause of TD = 1. 



HPT SPS 




BPT ^ LE ^ LSS SST TD 

Figure 7: Blowing up the target (refined version). 

Hall suggests that further complications arise if we add a second fighter plane escorting 
Suzy, piloted by Hillary. Billy still shoots down Enemy, but if he hadn't, Hillary would have. 
The natural way of dealing with this is to add just one more variable ///T representing Hillary's 
pulling the trigger iff LE = 1 (see FigurelTJ), but then, using the naive counterfactual criterion, 
one might conclude that the target will be destroyed {TD = 1) regardless of Billy's action, and 
BPT = 1 would lose its "actual cause" status (of TD = 1). Fortunately, our definition goes 
beyond this naive criterion and classifies BPT = 1 as a cause of TD = 1, as expected. This can 
be seen by noting that the partition Z = {BPT, LE, LSS, SST, TD}, W = {HPT, SPS} satisfies 
conditions AC1-AC3 (with w' such that HPT = and SPS = 1). The intuition rests, again, 
on structural contingencies; although Billy's action seems superfluous under ideal conditions, 
it becomes essential under a contingency in which Hillary would fail in her mission to shoot 
Enemy. This contingency is represented by setting HPT to (in testing AC2(a)), irrespective 
of LE. I 

5 A More Refined Definition 

We labeled our definition "preliminary", suggesting that there are some situations it cannot 
deal with. The following example illustrates the problem. 

Example 5.1: Consider Example 14.21 where both Suzy and Billy throw a rock at a bottle, but 
Suzy's hits first. Now suppose that there is a noise which causes Suzy to delay her throw 
slightly, but that she still throws before Billy. Suppose that we model this situation using the 
approach described in Figured adding three extra variables, (where = if there is no 
noise and = 1 if there is a noise), ifi.s (which is 1 if the bottle is hit at time ti.5, where 
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ti < ^1.5 < t2, and otherwise) and BSi,^ (which is 1 if the bottle is shattered at time ti s 
and otherwise). In the actual situation, there is a noise and the bottle shatters at ti 5, so 
= 1, i^i 5 = 1, and BSi ^ = 1. Just as in Example 14.21 we can show that Suzy's throw 
is a cause of the bottle shattering and Billy's throw is not. Not surprisingly, = 1 is a 
cause of BSi,5 = 1 (without the noise, the bottle would have shattered at time 1). Somewhat 
disconcertingly though, = 1 is also a cause of the bottle shattering. That is, = 1 is a 
cause of BS3 = 1. 

This seems unreasonable. Intuitively, the bottle would have shattered whether or not there 
had been a noise. However, this intuition is actually not correct in our causal model. Consider 
the contingency where Suzy's throw hits the bottle. If A^ = 1 and BSi = 0, then the bottle does 
shatter at ^1.5. Given this, it easily follows that, according to our definition, A^ = 1 is a cause 
of BS3 = 1}^ I 

The problem here is caused by what might be considered an extremely unreasonable sce- 
nario: If A^ = 1 and BSi = 0, the bottle does not shatter despite being hit by Suzy's rock. Do 
we want to consider such scenarios? That is up to the modeler. Intuitively, if we allow such 
scenarios, then the noise ought to be a cause; if not, then it shouldn't. 

It is easy to modify our preliminary definition so as to be able to capture this intuition. We 
take an extended causal model to now be a tuple [S, JF, £), where (5, T) is a causal model, 
and £^ is a set of allowable settings for the endogenous variables. That is, if the endogenous 
variables are Xi, . . . , X„, then (xi, . . . , Xn) G £^ if Xi = a:i, . . . , X„ = x„ is an allowable 
setting. We say that a setting of a subset of the endogenous variables is allowable if it can be 
extended to a setting in 8. We then slightly modify clauses AC2(a) and (b) in the definition of 
causality to restrict to allowable settings. In the special case where 8 consists of all settings, 
this definition reduces to the definition we gave in Section|3l We can deal with Example lS.ll in 
extended causal models by disallowing settings where BSi = A i/i = 1. This essentially puts 
us back in the original setting. The following example further illustrates the need to be able to 
deal with "unreasonable" settings. 

Example 5.2: Fred has his finger severed by a machine at the factory {FS = 1). Fortunately, 
Fred is covered by a health plan. He is rushed to the hospital, where his finger is sewn back 
on. A month later, the finger is fully functional (FF = 1). In this story, we would not want to 
say that FS = 1 is a cause of FF = 1 and, indeed, according to our definition, it is not, since 
FF = 1 whether or not FS = 1 (in all contingencies satisfying AC2(b)). 

However, suppose we introduce a new element to the story, representing a nonactual struc- 
tural contingency: Larry the Loanshark may be waiting outside the factory with the intention 
of cutting off Fred's finger, as a warning to him to repay his loan quickly. Let LL represent 
whether or not Larry is waiting and let LC represent whether Larry cuts off Fred's finger. If 
Larry cuts off Fred's finger, he will throw it away, so Fred will not be able to get it sewn back 
on. In the actual situation, LL = LC = 0; Larry is not waiting and Larry does not cut off 

'^We thank Chris Hitchcock for bringing this example to our attention. 
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Fred's finger. So, intuitively, there seems to be no harm in adding this fanciful element to the 
story. Or is there? Suppose that, if Fred's finger is cut off in the factory, then Larry will not be 
able to cut off the finger himself (since Fred will be rushed off to the hospital). Now FS = 1 
becomes a cause of FF = 1. For in the structural contingency where LL = 1, if FS = then 
FF = (Larry will cut off Fred's finger and throw it away, so it will not become functional 
again). Moreover, if FS = 1, then LC = and FF = 1, just as in the actual situation.'^ 

If we really want to view Larry's cutting off Fred's finger as totally fanciful, then we simply 
disallow all settings where LL = 1. On the other hand, if having fingers cut off in a way that 
they cannot be put on again is rather commonplace, then it seems more reasonable to view the 
accident as a cause of Fred's finger being functional a month after the accident. | 

In extended models, it is also straightforward to deal with problems of causation by omis- 
sion. 

Example 5.3: Hall and Paul 120031 give an example due to Sarah McGrath suggesting that 
there may be a difference between causation by omission and causation by commission: 

Suppose Suzy goes away on vacation, leaving her favorite plant in the hands of 
Billy, who has promised to water it. Billy fails to do so. The plant dies — but 
would not have, had Billy watered it. ... Billy's failure to water the plant caused 
its death. But Vladimir Putin also failed to water Suzy's plant. And, had he done 
so, it would not have died. Why do we also not count his omission as a cause of 
the plant's death? 

Billy is clearly a cause in the obvious structural model. So is Vladimir Putin, if we do not 
disallow any settings and include Putin watering the plant as one of the endogenous variables. 
However, if we simply disallow the setting where Vladimir Putin waters the plant, then Billy's 
failure to water the plants is a cause, and Putin's failure is not. We could equally well get this 
result by not taking Putin's watering the plant as one of the endogenous variables in the model. 
(Indeed, we suspect that most people modeling the problem would not include this as a random 
variable.) 

Are we giving ourselves too much flexibility here? We believe not. It is up to a modeler to 
defend her choice of model. A model which does not allow us to consider Putin watering the 
plant can be defended in the obvious way: that is a scenario too ridiculous to consider. On the 
other hand, if Suzy's sister Maggie (who has a key to the house) also came by to check up on 
things, then it does not seem so unreasonable for Suzy to get slightly annoyed at Maggie for 
not watering the plant, even if she was not supposed to be the one responsible for it. Intuitively, 
it seems reasonable not to disallow the setting where Maggie waters the plant. | 

'^We thank Eric Hiddleston for bringing this example to our attention. The example is actually a variant of one 
originally due to Kvart 119911 . although Kvart's example did not include Larry the Loanshark and was intended 
to show a violation of transitivity. 
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Considering only allowable settings plays a more significant role in our framework than 
just that of allowing us to ignore fanciful scenarios. As the following example shows, it helps 
clarify the relationship between various models of a story. 

Example 5.4: This example concerns what Hall calls the distinction between causation and 
determination. Again, we quote Hall 1200011 : 

The engineer is standing by a switch in the railroad tracks. A train approaches 
in the distance. She flips the switch, so that the train travels down the right-hand 
track, instead of the left. Since the tracks reconverge up ahead, the train arrives at 
its destination all the same . . . 

Again, our causal model gets this right. Suppose we have three random variables: 

• F for "flip", with values (the engineer doesn't flip the switch) and 1 (she does); 

• T for "track", with values (the train goes on the left-hand track) and 1 (it goes on the 
right-hand track); and 

• A for "arrival", with values (the train does not arrive at the point of reconvergence) and 
1 (it does). 

Now it is easy to see that flipping the switch {F = 1) causes the train to go down the left-hand 
track (T = 0), but does not cause it to arrive (A = 1), thanks to AC2(a) — whether or not the 
switch is flipped, the train arrives. 

However, our proposal goes one step beyond this simple picture. Suppose that we model 
the tracks using two variables: 

• LT for "left-track", with values 1 (the train goes on the left-hand track) and (it does not 
go on the left-hand track); and 

• RT for "right-track", with values 1 (the train goes on the right-hand track) and (it does 
not go on the right-hand track). 

The resulting causal diagram is shown in Figure HI it is isomorphic to a class of problems 
that Pearl II2000I calls "switching causation". It seems reasonable to disallow settings where 
RT = LT = 1; a train cannot go down more than one track. If we do not disallow any other 
settings, then, lo and behold, this representation classifies F = 1 as a cause of A. At first sight, 
this may seem counterintuitive: Can a change in representation turn a non-cause into a cause? 

It can and it should! The change to a two-variable model is not merely syntactic, but 
represents a profound change in the story. The two-variable model depicts the tracks as two 
independent mechanisms, thus allowing one track to be set (by action or mishap) to false (or 
true) without affecting the other. Specifically, this permits the disastrous mishap of flipping the 
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Figure 8: Flipping the switch. 

switch while the left track is malfunctioning. More formally, it allows a setting where F = \ 
and RT = 0. Such abnormal settings are imaginable and expressible in the two-variable model, 
but not in the one- variable model. Of course, if we disallow settings where F = 1 and RT = 0, 
or where F = and LT = 0, then we are essentially back at the earlier model. The potential 
for such settings is precisely what renders F = 1 a cause of A in the model of Figure[Hl'^ 

Is flipping the switch a legitimate cause of the train's arrival? Not in ideal situations, where 
all mechanisms work as specified. But this is not what causality (and causal modeling) are 
all about. Causal models earn their value in abnormal circumstances, created by structural 
contingencies, such as the possibility of a malfunctioning track. It is this possibility that should 
enter our mind whenever we decide to designate each track as a separate mechanism (i.e., 
equation) in the model and, keeping this contingency in mind, it should not be too odd to name 
the switch position a cause of the train arrival (or non-arrival). I 

Example 15 .41 gives some insight into the process of model construction. While there is no 
way of proving that a given model is the "right" model, it is clearly important for a model 
to have enough random variables to express what the modeler considers to be all reasonable 
situations. On the other hand, by allowing for the possibility of restricting the set of possible 
settings in the definition of causality, we do not penalize the modeler for inadvertently having 
too many possible settings. 

Example 5.5: The next pair of examples were introduced by Schaffer II2000II under the name 
trumping preemption. To quote Schaffer: 

Imagine that it is a law of magic that the first spell cast on a given day match the 
enchantment that midnight. Suppose that at noon Merlin casts a spell (the first 
that day) to turn the prince into a frog, that at 6:00 PM Morgana casts a spell (the 
only other that day) to turn the prince into a frog, and that at midnight the prince 
becomes a frog. 

Clearly Merlin is a cause of the enchantment. What about Morgana? There is an intuition that 
Merlin should be the only cause, since his spell "trumps" Morgana's. Can this be captured in a 
causal model? 

A coarse-grained model for this story has three variables: 

'^This can be seen by noting that condition AC2 is satisfied by the partition Z = {F, LT, A},W ~ {LT}, and 
choosing w' as the setting LT = 0. 
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• Mer, with values (Merlin did not cast a spell), 1 (Merlin cast a prince-to-frog spell in 
the morning), and 2 (Merlin cast a prince-to-frog spell in the evening) 

• Mor, with values 0, 1,2, with interpretations similar to those for Mer, 

• F, the outcome, with values (prince) or 1 (frog). 

In this model, with the obvious structural equations, both Merlin's spell and Morgana's spell 
are the causes of the transmogrification. (We do need to specify what happens if both Merlin 
and Morgana cast a spell at the same time. The choice does not affect the analysis.) The 
problem, of course, is that the model does not capture how Merlin's spell trumps Morgana's; 
Merlin and Morgana are being treated completely symmetrically. In particular, the model fails 
to represent the temporal precedence requirement that "the first spell on a given day match the 
enchantment that midnight". 

To prevent Morgana's spell from being a cause, we can use a model similar in spirit to that 
used in the rock-throwing example. We need two additional variables, MerE (for Merlin's spell 
effective) and MorE (for Morgana's spell effective). The picture is very similar to Figure El 
with MerE and MorE replacing SH and BH: 

Mer Mor 
MerE ► MorE 




F 



Figure 9: Merlin and Morgana. 

(Again, we are not specifying what happens if Merlin and Morgana throw at the same time, 
because it is irrelevant to the analysis.) In this model Morgana's spell is not a cause; it fails 
AC2(b). This again emphasizes the point that causality is relative to a model. It is up to the 
modeler to ensure that the structural equations properly represent the dynamics in the story. 

The second example of trumping preemption is actually due to Bas van Fraassen. Quoting 
Schaffer again: 

Imagine that . . . the major and the sergeant stand before the corporal, both shout 
"Charge!" at the same time, and the corporal decides to charge. 

Schaffer (and Lewis II2000I ') claim that, because orders from higher-ranking soldiers trump 
those of lower-ranking soldiers, this is again a case of trumping preemption: the major is a 
cause of the charge; the sergeant is not. 

"^The variable could take on more values, allowing for other spells that Merlin could cast and other times he 
could cast them, but this would not affect the analysis. 
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Our intuition does not completely agree with that of Schaffer and Lewis in this example. In 
what seems to us the most obvious model of the story, both the sergeant's order and the major's 
order are the causes of the advance. Consider the model described in Figure [121 Assume for 
definiteness that the sergeant and the major can each either order an advance, order a retreat, or 
do nothing. Thus, M and S can each take three values, 1, —1, or 0, depending on what they do. 
A describes what the solders do; as the story suggests, A = M if M 7^ 0; otherwise A = S. 
In the actual context, M = S = A = \. \n this model, it is easy to see that both M = 1 and 
S = 1 are causes of A = 1, although M = 1 is a strong cause of A = 1, while S* = 1 is not. 
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Figure 10: A simple model of the sergeant and the major 

Of course, it is possible to get a model of the story that arguably captures trumping by 
modeling the fact that if the major actually issues an order, then the sergeant is ignored. To 
do this, we add a new variable SE that captures the sergeant's "effective" order. If the major 
does not issue any orders (i.e., if M = 0), then SE = S. If the major does issue an order, 
then SE = 0; the sergeant's order is effectively blocked. In this model, illustrated in Figure fTTl 
A = MifM ^0; otherwise, A = SE. 
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Figure 1 1: A model of the sergeant and the major that captures trumping. 

In this model, the major does cause the corporal to advance, but the sergeant does not. 
For suppose we want to argue that = 1 causes A = 1. The obvious thing to do is to take 
W = {M} and Z = {S, SE, A}. However, this choice does not satisfy AC2(b), since if M = 0, 
SE = (its original value), and S = 1, then A = 0, not 1. We leave it to the reader to check 
that it does not help to put SE into W. The key point is that this more refined model allows 
a setting where M = 0, S = 1, and ^4 = (because SE = 0). That is, despite the sergeant 
issuing an order to attack and the major being silent, the corporal does nothing (intuitively, 
because of some perceived "interference" from the major, despite the major being silent). 

Schaffer 1120001 p. 175-176] seems to want to disallow this model, or at least to allow other 
mechanisms for trumping. There may well be other mechanisms for trumping. We believe that 
if they are spelled out carefully, it should also be possible to capture them using an appropriate 
causal model. However, we cannot speak about trumping preemption in our framework without 
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being explicit as to how the trumping takes place. 

It is important to note that the diversity of answers in these examples does not reflect undis- 
ciplined freedom to tinker with the model so as to get the desired answer. Quite the contrary; it 
reflects an ambiguity in the original specification of the story, which our definition helps disam- 
biguate. Each of the models considered reflects a legitimate interpretation of the story in terms 
of a distinct model of the corporal's attention-focusing strategy. For example, Figure [TOl de- 
scribes the corporal's strategy as a single input-output mechanism, with no intermediate steps. 
Figure[TT]refines that model into a two-step process where the corporal first determines whether 
the major is silent or speaking and, in the latter case, follow the major's command. Naturally, 
the major should be deemed the cause of advancing (in our scenario) given this strategy. We 
can also imagine a completely different strategy where the sergeant, not the major, will be 
deemed the cause of advancing. If the corporal first determines whether or not there is con- 
flict between the two commanders and then, in case of no conflict, pays full attention to the 
sergeant (perhaps because his dialect is clearer, or his posture less intimidating), it would make 
perfect sense then to say that the sergeant was the cause of advancing. Structural-equation 
models provide a language for formally representing these fine but important distinctions, and 
our definition translates these distinctions into different classifications of actual causes. | 

Example 5.6: Consider an example originally due to McDermott II1995I . and also considered 
by Collins ll200f1 . Lewis ll2000ll . and Hitchcock llIOOTl . A baU is caught by a fielder. A little 
further along its path there is a solid wall and, beyond that, a window. Does the fielder's catch 
cause the window to remain unbroken? As Lewis 120001 says. 

We are ambivalent. We can think: Yes — the fielder and the wall between them 
prevented the window from being broken, but the wall had nothing to do with it, 
since the ball never reached the wall; so it must have been the fielder. Or instead 
we can think: No — the wall kept the window safe regardless of what the fielder 
did or didn't do. 

Lewis argues that our ambivalence in this case ought to be respected, and both solutions 
should be allowed. We can give this ambivalence formal expression in our framework. If we 
make both the wall and the fielder endogenous variables, then the fielder's catch is a cause of 
the window being safe, under the assumption that the fielder not catching the ball and the wall 
not being there is considered a reasonable scenario. Note that if we also have a variable for 
whether the ball hit the wall, then the presence of the wall is not a cause for the window's being 
safe in this case; the analysis is essentially the same as that of the Suzy-Billy rock-throwing 
example in Figure|3]^° On the other hand, if we take it for granted the wall's presence (either by 
making the wall an exogenous variable, not including it in the model, or not allowing situations 

'^Of course, we could extend the framework to allow epistemic considerations, using a standard possible- 
worlds framework, where the "worlds" are causal models. An agent could then be uncertain about how the 
trumping takes place, while still knowing that the major is the cause of charge, not the sergeant. Nevertheless, in 
each of the possible worlds, the trumping mechanism would still have to be specified. 

^"We thank Chris Hitchcock for making this point. 
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where it doesn't block the ball if the fielder doesn't catch it), then the fielder's catch is not a 
cause of the window being safe. It would remain safe no matter what the fielder did, in any 
structural contingency. 

This example again stresses the importance of the choice of model, and thinking through 
what we want to vary and what we want to keep fixed. (Much the same point is made by 
Hitchcock lEUOn .) I 

This is perhaps a good place to compare our approach with that of Yablo II2002I . The 
approaches have some surface similarities. They both refine the standard notion of counterfac- 
tual dependence. We consider counterfactual dependence under some (possibly counterfactual) 
contingency. Yablo considers counterfactual dependence under the assumption that some fea- 
ture of (or events in) the actual world remains fixed. The problem is, as Yablo himself shows, 
that for any X = x and 99 that actually happens, we can find some feature of the world that we 
can hold fixed such that Lp depends onX = x. Take ^ to be the formula X = x <^ ip.\f X = x 
and Lp are both true in the actual situation, then so is ifj. Moreover, under the assumption that 
^ holds, Lp depends counterfactually on X = x. In the closest world to the actual world where 
X = xAip holds, ip must hold, while in the closest world to the actual world where X ^ xAip 
holds, must hold. To counteract such difficulties, Yablo imposes a requirement of "natural- 
ness" on what can be held fixed. With these requirement, a more refined notion of causation 
is that X = X is a cause of ip if there is some tp true in the actual world that can be held fixed 
so as to make ip counterfactually depend on X = x, and no other "more natural" tp' can be 
found that makes the dependence "artificial". While Yablo does give some objective criteria 
for naturalness, much of the judgment is subjective, and it is not clear how to model it formally. 
In other words, it is not clear what relationships among variables and events must be encoded 
in the model in order to formally decide whether one event is "more natural" than another, 
or whether no other "more natural" event can be contrived. The analogous decisions in our 
formulation are managed by condition AC2(b), which distinguishes unambiguously between 
admissible and inadmissible contingencies. In addition, it restricts the form of contingencies; 
only contingencies of the form W = w are allowed, and not, for example, contingencies such 
asX = Y. 

6 Discussion 

We have presented a formal representation of causal knowledge and a principled way of deter- 
mining actual causes from such knowledge. We have shown that the counterfactual approach 
to causation, in the tradition of Hume and Lewis, need not be abandoned; the language of coun- 
terfactuals, once supported with structural semantics, can yield a plausible and elegant account 
of actual causation that resolves major difficulties in the traditional account. 

The essential principles of our account include 

• using structural equations to model causal mechanisms and counterfactuals; 
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• using uniform counterfactual notation to encode and distinguish facts, actions, outcomes, 
processes, and contingencies; 

• using structural contingencies to uncover latent counterfactual dependencies; 

• careful screening of these contingencies to avoid tampering with the causal processes to 
be uncovered. 



Our approach also stresses the importance of careful modeling. In particular, it shows that 
the choice of model granularity can have a significant effect on the causality relation. This 
perhaps can be viewed as a deficiency in the approach. We prefer to think that it shows that 
the internal structures of the processes assumed to underlie causal stories play a crucial role in 
our judgment of actual causation, and that it is important therefore to properly cast such stories 
in a language that represents those structures explicitly. Our approach is built on just such a 
language. 

As the examples have shown, much depends on choosing the "right" set of variables with 
which to model a situation, which ones to make exogenous, and which to make endogenous. 
While the examples have suggested some heuristics for making appropriate choices, we do not 
have a general theory for how to make these choices. We view this as an important direction for 
future research. (See HHitchcock 20031 for some preliminary discussion of the issue of finding 
"good" models.) 

While we do feel that it should be possible to delineate good guidelines for constructing 
appropriate models, ultimately, the choice of model is a subjective one. The choice of which 
variables to focus on and which to ignore (that is, the choice of exogenous and endogenous 
variables) and the decision as to which contingencies to take seriously (that is, which settings to 
take as allowable) is subjective, and depends to some extent on what the model is being used for. 
(This issue arises frequently in discussions of causality and the law HHart and Honore 19851 .) 
By way of contrast, most of the work in the philosophy literature seems to implicitly assume 
that, in any given situation, there is one correct answer as to whether A is a cause of B. Rather 
than starting with a model, there are assumed to be events in the world; new events can be 
created to some extent as needed, leading to issues like "fragility" of events and how fine- 
grained events should be (see, for example, ILewis 20001 IPaul 20001 ). 

of causality is "right". However, the fact that it deals so well with the many difficult exam- 
ples in the literature does provide some support for the reasonableness of the definition. Further 
support is provided by the ease with which it can be extended to define other notions, such as 



explanation (see Part II of this paper) and responsibility and blame | Chockler and Halpem 2004 1 



A Appendix: Some Technical Issues 

In this appendix, we consider some technical issues related to the definition of causality. 
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A.l The active causal process 

We first show that, without loss of generality, the variables in the set Z in condition AC2 of the 
definition of causality can all be taken to be on a path from a variable in X to a variable in 
In fact, they can, without loss of generality, be assumed to change value when X is set to x' 
and W is set to w' . More formally, consider the following strengthening of AC2: 

AC2'. There exists a partition (Z, of V with X C Z and some setting (x', td') of the 
variables in {X , W) such that, if (M, u) \= Z = z* for Z e Z, then 

(a) (M, u)^[X <- x', W ^ w'] {^ipAZ^ z*) for all Z e Z; 

(b) (M, u) ^ [X <- x,W ^ w', Z' i- z*]ip for all subsets Z' of Z. 

As we now show, we could have replaced AC2 by AC2'; it would not have affected the 
notion of causality. Say that X = x is an actual cause' of ip if ACl, AC2', and ACS hold. 

— * — * 

Proposition A.l: X = x is an actual cause ofipiffX = x is an actual cause' oftp. 

Proof: The "if" direction is immediate, since AC2' clearly implies AC2. For the "only if" 
direction, suppose that X = xisa cause of if. Let (Z, W) be the partition of V and (x', w') the 
setting of the variables in {X, W) guaranteed to exist by AC2. Let Z' (1 Z consist of variables 
Z e Z such that (M, u) ^ [X ^ f, W ^ w']{Z z*). Let W' = V - Z'. Notice that 
W' is a superset of W. Moreover, a priori, W' may contain some variables in X, although we 
shall show that this is not the case. Let w" be a setting of the variables in W that agrees with 
w' on the variables in W and for Z E Z D W', sets Z to z* (its original value). Note that if 
there is a variable V E X D W', then the setting of V is the same in of, x, and w". Thus, even 
if X and W' have a nonempty intersection, the models M^^^, ^^^t and M^^^, y^,^^,, are 
well defined. Since Z = z* in the unique solution to the equations in M^^^, and the 
equations in M^^^ ^^^„ it follows that (a) the equations in M^^^, ^,^^„ and M^^^,^^^, 
have the same solutions and (b) the equations in M^^^ w'^w" ^x^x w^w' ^^^^ same 
solutions. Thus, {M,u) |= [X ^ x',W' ^ w"]{^Lp A {Z ^ z*)) for all Z E Z' and 
(M, u) \= [X ^ x,W ^ w']{ip A (Z = z*)) for all Z E Z'. That is, AC2' (and hence AC2) 
holds for the pair {Z', W'). It follows that W' f] X = 0, for otherwise X = x is not a cause of 
if: it violates ACS. Thus, Z' 3 X, and X = x is a cause' of ip, as desired. | 

Proposition lA. 1 1 shows that, without loss of generality, the variables in Z can be taken to 
be "active" in the causal process, in that they change value when the variables in X do. This 
means that each variable in Z must be a descendant of some variable in X in the causal graph. 
The next result shows that, without loss of generality, we can also assume that the variables in 
Z are on a path from a variable in X to a variable that appears in (p. Recall that we defined an 
active causal process to consist of a minimal set Z that satisfies AC2. 
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Proposition A.2: All the variables in an active causal process corresponding to a cause X = x 
for Lp in (M, u) must be on a path from some variable in X to a variable in ip in the causal 
network corresponding to M. 

Proof: Suppose that Z is an active causal process, (Z, W) is the partition satisfying AC2 using 
the setting (a;', w'). By Proposition lA.il all the variables in Z must be descendants of a variable 
in X. Suppose that some variable Z E Z h not on a path from a variable in J? to a variable in 
That means there is no path from Z to a variable in y?. It follows that there is no path from 
Z to a variable Z' E Z that is on a path from a variable in X to a variable in Thus, changing 
the value of Z cannot affect the value of ip nor of any variable Z' E Z. Let Z' = Z — {Z} and 
W' = W U {Z}. Extend w' to w" by assigning Z to its original value z* in context (M, u). It 
is now immediate from the preceding observations that (Z', W') is a partition satisfying AC2 
using the setting (x', w"). This contradicts the minimality of Z. | 

A.2 A closer look at AC2(b) 

Clause AC2(b) in the definition of causality is complicated by the need to check that ip remains 
true if X is set to x, any subset of the variables in W is set to w', and all the variables in an 
arbitrary subset Z' of Z are set to their original values z* (that is, the values they had in the 
original context, where X = x and W = w). This check would be simplified considerably if, 
for each variable z E Z and each subset W' of 1^, we have that Z = z* when X = x and 
W' = w'; that is, if we require in AC2(b) that (M, u) |= [X ^ x,W' ^ w']{Z = z*) for all 
variables Z E Z and all subsets W' of W. (Note that this requirement would imply the current 
requirement.) This stronger requirement holds in all the examples we have considered so far. 
However, the following example shows that it does not hold in general. 

Example A.3: Imagine that a vote takes place. For simplicity, two people vote. The measure is 
passed if at least one of them votes in favor. In fact, both of them vote in favor, and the measure 
passes. This version of the story is almost identical to the disjunctive scenario in Example l3.2l 
If we use Vi and V2 to denote how the voters vote (V^ = if voter i votes against and Vi = 1 
if she votes in favor) and P to denote whether the measure passes (P = 1 if it passes, P = 
if it doesn't), then in the context where Vi = V2 = 1, it is easy to see that each of Vi = 1 and 
^2 = 1 is a cause of P = 1. However, suppose we now assume that there is a voting machine 
that tabulates the votes. Let M represent the total number of votes recorded by the machine. 
Clearly M = V1 + V2 and P = 1 iff Af > 1 . The following causal network represents this more 
refined version of the story. In this more refined scenario, Vi = 1 and V2 = 1 are still both 
causes of P = L Consider Vi = I. Take Z = {Vi, M, P} andW = V2. Much like the simpler 
version of the story, if we choose the contingency V2 = 0, then P is counterfactually dependent 
on Vi, so AC2(a) holds. To check that this contingency satisfies AC2(b), note that setting Vi 
to 1 and V2 to results in P = 1, even if we also set M to 2 (its current value). However, 
if we had insisted in AC2(b) that {M,u) \= [X ^ x,W ^ w']{Z = z*) for all variables 
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Figure 12: An example showing the need for AC2(b). 

Z ^ Z (which in this case means that M would have to retain its original value of 2 when 
Vi = 1 and V2 = 0), then neither Vi = 1 nor V2 = 1 would be a cause of P = 1 (although 
Vi = 1 A V2 = 1 would be a cause of P = 1). Since, in general, one can always imagine 
that a change in one variable produces some feeble change in another, we cannot insist on the 
variables in Z remaining constant; instead, we require merely that changes in Z not affect Lp. | 

We remark that this example is not handled correctly by Pearl's causal beam definition. 
According to the causal beam definition, there is no cause for F = 1 ! It can be shown that 
if X = X is an actual (or contributory) cause oiY = y according to the causal beam def- 
inition given in UPearl 200 01. then it is an actual cause according to the definition here. As 
Example |A3] shows, the converse is not necessarily true. 

Another complicating factor in AC2(b) is that the requirement must hold for all subsets W' 
of W . In a preliminary version of this paper [ Halpem and Pearl 2001| , we required only that 



AC2(b) hold for W . That is, the condition we had was 

AC2(b'). (M, u)'^[X ^ x,W ^ w', Z' 4- ^\Lp for all subsets Z' of Z. 

However, as Hopkins and Pearl II2002I pointed out, AC2(b') is too permissive. To use their 
example, suppose that a prisoner dies either if A loads B\ gun and B shoots, or if C loads and 
shoots his gun. Taking D to represent the prisoner's death and making the obvious assumptions 
about the meaning of the variables, we have that D = 1 iff (yl = \I\B = 1) V(C = 1). Suppose 
that in the actual context u, A loads B's gun, B does not shoot, but C does load and shoot his 
gun, so that the prisoner dies. Clearly C = 1 is a cause of D = 1. We would not want to say 
that A = 1 is a cause of D = 1, given that B did not shoot (i.e., given that B = 0). However, 
with AC2(b'), A = 1 is a cause of D = 1. For we can take W = {B,C} and consider the 
contingency where B = 1 and C = 0. It is easy to check that AC2(a) and AC2(b') hold for this 
contingency, so under the old definition, A = 1 was a cause of D = 1. However, AC2(b) fails 
in this case, for {M,u) ^ [A ^ 1,C <~ 0]D = 0. 



A.3 Causality with infinitely many variables 

Throughout this paper, we have assumed that V, the set of exogenous variables, is finite. Our 
definition (in particular, the minimality clause AC3) has to be modified if we drop this assump- 
tion. To see why, consider the following example: 
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Example A.4: Suppose that V = {Xq, Xi, X2, . . . , Y}. Further assume that the structural 
equations are such that F = 1 iff infinitely many of the Xj's are 1; otherwise Y = 0. Suppose 
that in the actual context, all of the X/s are 1 and, of course, so is Y. What is the cause of 
y = 1? 

According to our current definitions, it is actually not hard to check that there is no event 
which is the cause of y = 1. For suppose that Ajg/Xj = 1 is a cause of F = 1, for some subset 
/ of the natural numbers. If / is finite, then to satisfy AC2(a), we must take to be a cofinite 
subset of the X/s (that is, ly must include all but finitely many of the Xj's). But then if we set 
all but finitely many of the X/s in to (as we must to satisfy AC2(a) if / is finite), AC2(b) 
fails. On the other hand, if I is infinite and there exists a partition {Z, W) such that AC2(a) 
and (b) hold, then if /' is the result of removing the smallest element from I, it is easy to see 
that Ajg/'Xj = 1 also satisfies AC2(a) and (b), so AC3 fails. | 

Example lA.4l shows that the definition of causality must be modified if V is infinite. It seems 
that the minimality condition AC3 should be modified. Here is a suggested modification: 

AC3'. If any strict subset X' of X satisfies conditions ACl and AC2, then there is a strict 
subset X" of X' that also satisfies ACl and AC2. 

It is easy to see that AC3 and AC3' agree if V is finite. Roughly speaking, AC3' says that if 
there is a minimal conjunction that satisfies ACl and AC2, then it is a cause. If there is no 
minimal one (because there is an infinite descending sequence), then any conjunction along 
the sequence qualifies as a cause. 

If we use AC3' instead of AC3, then in Example I A. 41 Aje/Xj = 1 is a cause of F = 1 as 
long as / is infinite. Note that it is no longer the case that we can restrict to a single conjunct if 
V is infinite. 

We do not have sufficient experience with this definition to be confident that it is indeed 
just what we want, but it seems like a reasonable choice. 

A.4 Causality in nonrecursive models 

We conclude by considering how the definition of causality can be modified to deal with non- 
recursive models. In nonrecursive models, there may be more than one solution to an equation 
in a given context, or there may be none. In particular, that means that a context no longer nec- 
essarily determines the values of the endogenous variables. Earlier, we identified a primitive 
event such as X = s with the basic causal formula [](X = x), that is, with the special case of 
a formula of the form [Yi ^ . . . , 1^ <— yk](p with A; = 0. (M, u) |= []{X = x) if X = x 
in all solutions to the equations where U = u. It seems reasonable to identify [ ] (X = x) with 
X = a; if there is a unique solution to these equations. But it is not so reasonable if there may 
be several solutions, or no solution. What we really want to do is to be able to say that X = x 
under a particular setting of the variables. Thus, we now take the truth of a primitive event such 
as X = X relative not just to a context, but to a complete description {u, v) of the values of both 
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the exogenous and the endogenous variables. That is, (M , u,v) \= X = x if X has value x in 
V. Since the truth of X = x depends on just v, not u, we sometimes write (M, v) \= X = x. 
We extend this definition to Boolean combinations of primitive events in the standard way. We 
then define (Af, u,v) \= [Y y\ip if (M, v') \= ip for all solutions (u, v') to the equations in 
Mf^g. Since the truth of [y ^ (X = x) depends only on the context u and not on v, we 
typically write (M, u) |= [Y ^ y\{X = x). 

The formula {Y ^ y){X = x) is the dual of [Y ^ y\{X = x); that is, it is an abbreviation 
of ^ y\iX 7^ x). It is easy to check that {M,u,v) |= {Y ^ y){X = x) if in some 
solution to the equations in M^^^ in context u, the variable X has value x. For recursive 

models, it is immediate that [Y ^ y\{X = x) is equivalent to (Y ^ y){X = x), since all 
equations have exactly one solution. 

With these definitions in hand, it is easy to state our definition of causality for arbitrary 
models. Note it is now taken with respect to a tuple (M, u, v), since we need the values of the 
exogenous variables to define the actual world. 

Definition A.5: X = x is an actual cause ofip in {M, u, v) if the following three conditions 
hold. 

ACl. {M,v) ^ (X = x) Av?. 

AC2. There exists a partition {Z,W) of V with X C Z and some setting {x',w') of the 
variables in {X , W) such that if (M, u,v) \= Z = z*, then 

(a) (M, u) ^ {X ^ x',W ^ w')^ip. 

(b) (M, u) \= [X ^ x,W ^ w', Z' ^ z*]ip for all subsets Z' of Z. (Note that in part 

(a) we require that the value of ip change only in some solution to the equations, 
while in (b), we require that it stay true in all solutions.) 

ACS. X is minimal; no subset of X satisfies conditions ACl and AC2. | 

While this seems like the most natural generalization of the definition of causality to deal 
with nonrecursive models, we have not examined examples to verify that this definition gives 
the expected result, partly because all the standard examples are most naturally modeled using 
recursive models. 
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